asked on

Protecting text fields from html code

I have a client who has been using a HTML form questionaire for quite sometime. Recently she's been receiving 2-3 messages a day through this form with the text fields filled out with html code directing here to porn links etc.

How do I protect the text fields from accepting html code. They should only accept text only. It's a simple html form.

Please advise. Thanks in advance for your input!

ASKER CERTIFIED SOLUTION

netmunky

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

rexnkaren

ASKER

The form does not post anything back to the site is only submits via email to my client. She has been getting them with porn links, talk of incest & msc. Is it ok to copy & paste her lates email the way it came into her? It doesn't have any pics or anything. Just html links.

netmunky

if it is simply just emailing her the information, i would suggest adding the freecap captcha to the form. this will prevent any submitions where the person does not enter what they see in the image

http://en.wikipedia.org/wiki/Captcha

rexnkaren

ASKER

Thank you. I'll check it out and return to update & award points if appropriate...

rexnkaren

ASKER

At first glance I'm seeing any directions on how to use this software. ? I've downloaded but now what?

netmunky

on the HTML form you would include:
<img id="freecap" src="/freecap/freecap.php" /><br/>
<input type="text" name="captcha" id="captcha" /><br/>
Cannot read the image? <a href="#" onclick="document.getElementById('freecap').
src='/guestbook/freecap/freecap.php?'+Math.random();">Click Here</a><br/>

in the form submission, you would have:
session_start();
if( !isset($_POST['captcha']) ||
!isset($_SESSION['freecap_word_hash']) ||
$_SESSION['hash_func']($_POST['captcha']) != $_SESSION['freecap_word_hash'] )
{
unset( $_SESSION['freecap_word_hash'] );
die("The word you entered did not match the image.<br/>");
}

you can give more friendly error messages if you want, but that is the basics.

rexnkaren

ASKER

Hmmm...what did I do wrong? http://www.karenkfisher.com/74_Ranch/questionnairewcaptcha.html

netmunky

html is not a PHP file

you can only use freecap if you are using PHP for the form handling. you can not put the PHP source code into a static HTML file.

netmunky

you're also using FormMail.cgi, which I likely to be PERL, not PHP

netmunky

if you're usign FormMail from Matt's Script Archive, check out http://www.formmail.com/captcha/

rexnkaren

ASKER

I'm going to check it out. Please don't give up & desert me. Thank you! (0:

rexnkaren

ASKER

Hmm...so, if I want to use the freecap I would need to build a form and submit without formmail? I guess I'll need to check out how to do that. Would you be able to write the code to put all this together? I can write another question so you can have more points. Is that kosher?

netmunky

you can download sample php form to email script here: http://formtoemail.com/